On October 21, 2026, security researchers disclosed two critical vulnerabilities in PHP, a widely used programming language that powers millions of websites, including those built on WordPress.
These vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, could allow attackers to gain unauthorized access to vulnerable websites, steal sensitive information, or take control of the servers hosting them.
These vulnerabilities do not affect Dutchie's platform, including Dutchie POS and Dutchie E-Commerce. However, dispensaries that operate their own websites, particularly those using WordPress, may be at risk.
If your dispensary operates a website independently of Dutchie, this article explains what you need to know, how to determine whether your website may be affected, and what steps you should take immediately.
Things to know
- Dutchie is not affected. These vulnerabilities do not impact Dutchie POS or Dutchie E-Commerce.
- Your dispensary's website may be affected. Websites running WordPress or other PHP-based platforms may be vulnerable, even if WordPress itself is fully updated.
- Attackers are already exploiting these vulnerabilities. Security researchers have reported active exploitation, making this an urgent issue for affected websites.
- Updating WordPress alone is not enough. These vulnerabilities exist in PHP itself, which is often managed by your website hosting provider.
- You may need help from your hosting provider. If someone else manages your website, share this article with them and request confirmation that your hosting environment has been secured.
What are these vulnerabilities?
PHP is the underlying technology used by many popular website platforms, including WordPress.
Security researchers recently discovered serious vulnerabilities in PHP that could allow attackers to compromise websites without needing a valid username or password.
A successful attack could allow someone to:
- Gain unauthorized control over your website.
- Access sensitive information stored on your hosting server.
- Modify website content or redirect visitors to malicious websites.
- Install malicious code that allows attackers to maintain access.
- Disrupt your website, potentially making it unavailable to customers.
Unlike traditional WordPress vulnerabilities that affect specific plugins or themes, these issues exist in the underlying PHP software.
This means that even websites running the latest version of WordPress may still be vulnerable if their hosting environment has not been updated.
What you should do immediately
1. Contact your website hosting provider
This is the most important step.
If your dispensary uses a hosting provider or third-party developer to manage its website, contact them immediately and ask whether your website is affected by CVE-2026-109618 or CVE-2026-109619.
Ask them to confirm that your hosting environment has received the appropriate PHP security updates.
2. Verify that PHP has been updated
The PHP development team has released security updates to address these vulnerabilities.
The following PHP versions contain the fixes:
- PHP 8.5.12
- PHP 8.4.27
- PHP 8.3.36
- PHP 8.2.35
If your website uses an older PHP version, work with your hosting provider to upgrade to a supported, patched release as soon as possible. Hosting providers may also supply security fixes through their own software packages.
Some hosting providers manage PHP updates automatically, while others require customers to request or perform upgrades.
3. Review your website for suspicious activity
Check your website for signs of a possible compromise, including:
- Unexpected redirects to unfamiliar websites.
- New or modified pages that your team did not create.
- Unrecognized WordPress administrator accounts.
- Unusual popups, advertisements, or verification prompts.
- Reports from customers that your website is behaving unexpectedly.
If you notice anything suspicious, contact your website administrator or hosting provider immediately.
4. Keep WordPress, plugins, and themes updated
Although these vulnerabilities exist in PHP itself, keeping WordPress and its components updated remains an important part of protecting your website.
Make sure your WordPress installation, themes, and plugins are running supported, up-to-date versions.
5. Confirm additional protections are in place
Ask your hosting provider whether they have implemented additional security protections, such as a web application firewall (WAF), to help block attempts to exploit these vulnerabilities.
These protections can help reduce risk while updates are being applied, but they are not a replacement for patching PHP.
What if my website has already been compromised?
If you suspect your website has been compromised, contact your hosting provider or website administrator immediately.
They should investigate suspicious activity, identify and remove malicious code, review administrator accounts, and ensure the underlying vulnerabilities have been addressed.
Simply removing suspicious content may not be enough if an attacker has established another way to access your website.
For additional information on identifying and responding to website compromises, review our previously published website security guidance.
Troubleshooting
Q: Are Dutchie POS or Dutchie E-Commerce affected?
A: No. Dutchie's platform is not affected by these vulnerabilities. However, if your dispensary operates a separate WordPress website alongside Dutchie E-Commerce or Dutchie Storefront, that website's hosting environment may be vulnerable.
Q: My WordPress website is fully updated. Am I safe?
A: Not necessarily. These vulnerabilities affect PHP, the underlying technology WordPress relies on. Even a fully updated WordPress installation may be vulnerable if the server's PHP software has not been patched.
Q: How do I know whether my website uses PHP?
A: WordPress websites rely on PHP. If you're unsure what technology your website uses, contact your website developer or hosting provider.
Q: Can Dutchie update PHP for my website?
A: If your website is independently hosted or managed by a third party, Dutchie does not control its underlying PHP installation. You'll need to work with your website hosting provider or developer to apply the necessary updates.
Q: Should I take my website offline?
A: If your website is vulnerable and cannot be patched immediately, discuss temporary protective measures with your hosting provider. Depending on your exposure, temporarily disabling the affected website may be appropriate until it can be secured.
Additional resources
- Official CVE-2026-109618 vulnerability record
- Official CVE-2026-109619 vulnerability record
- Krebs on Security: Widespread PHP Flaw May Cause Many Site Outages Today
- PHP Official Security Updates
- Dutchie website security guidance
Questions?
If you have questions about this article or believe your website may be affected, contact Dutchie Security at security@dutchie.com.
For assistance updating or securing an independently hosted website, contact your website hosting provider or developer directly.